1. 1 The Botherd is Coming! Part II The Technical Response Justin Azoff University at Albany EDUCAUSE Live! June 21 st, 2006

2. 2 Early 2004... or “Why is the Internet so slow?” ● Packetshaper dying every night, why? ● Dump flows every 10 minutes to find out – Handful of machines with 80,000 HTTP flows and one IRC flow ● What does this mean? – DDoS attacks using IRC Command and Control servers(C&C's)

3. 3 Port 6667 or “How not to block IRC” ● Port 6667 is the usual IRC Port. ● Compromised machines are... – Not your usual IRC client – Not going to use port 6667 ● But the PacketShaper recognizes IRC on any port (like an IDS would)! – Change the policy on all IRC classes to never- admit – Copy the IRC class. Restrict this class to a host list of “OK” IRC servers.

4. 4 StnyFtpd 0wns j0 or “How do you find infected machines?” ● Ask the PacketShaper for the list of IPs that have flows in the IRC classes. ● Do a full port scan on each and fetch all the banners. ● Compare the fetched banners to a list of “bad” ones - – “: USERID : UNIX : ”, “StnyFtpd”, “Bot Server” – Any machine with one of these banners gets disconnected from the network.

5. 5 Service Pack 2 or “Where did all the hacked machines go?” ● Built-in firewall in SP2 makes port scanning useless. ● Infected machines cannot be detected by scanning – no open ports ● Clean machines on the other hand are much safer than before ● This means no more worms, right? :-)

6. 6 “LOL this looks JUST like you!!” or “Social engineering applied to Gen-Y” ● With SP2, machines can't be infected from the outside ● Everyone and their mother has an AOL ® Instant Messenger ® account ● AIM ® Provides a nice platform for attackers- injects malware directly into PC. – Lack of virus/malware filters ● Any mail service these days does this – No accountability from AOL ® ● see http://www.aim.com/help_faq/security/trojan.adp

7. 7 Types of botnets or “2^32 or a lot more” ● IRC Bots generally come in 2 flavors – IP Based – DNS Based ● IP Based – Bots have one or more C&C IP addresses embedded in them. ● DNS Based – Bots have one or more C&C host names embedded in them.

8. 8 IP Based Botnets or “Why dns was invented in the first place” ● An easy game of whack-a-mole ● Shut down or block access to the IP address and the botnet dies. ● Not as popular as DNS based botnets. ● Easy to detect – Snort – Netflow

9. 9 DNS Based Botnets or “Highly available, load balanced, redundant botnets” ● Additional level of redirection ● Bots can be configured with multiple names, each resolving to a pool of C&C's ● Shutting down a domain is harder than shutting down an IP – hopping between registrars.

10. 10 You.GotPwndBy.Us or “Why you should log dns queries” ● When DNS based bots wake up, they have to resolve the C&C hostname to an IP address. ● They will likely use your DNS servers to do so. ● Even if the botnet is shutdown or dormant, they will still resolve the name.

11. 11 200,000 queries a day or “Please make it stop!” ● How do you log DNS queries? ● Have the DNS server do it? – requires reconfiguration, various issues ● Sniff the packets? – Works, but where to put the data? ● Privacy issues? – what to log, and for how long?

12. 12 DNSDB or “it mostly works” ● SNORT can do it, but its db has a lot of overhead – many many tables. ● Create a custom db instead - time, src, dst, name ● Another table to store bad names – the name, why it's bad, and if resolving it is sufficient for suspension. ● Have logging program only log names that appear in the “bad” table – solves privacy issues.

13. 13 Sandboxes and VMs or “Sources of bad names” ● Watching known-infected machines ● Analysis of queries ● only possible if you log all queries – hosts repeatedly resolving the same name – hosts resolving names not ending in.com,.net,.org,.edu ● Malware analysis – VMWARE etc – Norman Sandbox - sandbox.norman.no

14. 14 Norman Sandbox or “A great resource, but proprietary” ● Runs an executable in a controlled environment and gives you a report ● http://sandbox.norman.no/live_5.html?find=squid.oxxname.com ● [ Changes to filesystem ] * Creates file C:\WINDOWS\svchost.exe. * Deletes file c:\sample.exe.... [ Network services ] * Opens URL: http://www.nulloxx.net/[REMOVED]/. * Connects to "squid.oxxname.com" on port 4280 (TCP).

15. 15 Questions? or “huh?” ● Slides online at http://www.albany.edu/~ja6447/educause/